KERN KI Chat-Bot Example

LinkifyIt#match scan loop has quadratic algorithmic complexity

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

flatted vulnerable to unbounded recursion DoS in parse() revive phase

ajv has ReDoS when using `$data` option

Undici has an HTTP Request/Response Smuggling issue

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

markdown-it is has a Regular Expression Denial of Service (ReDoS)

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Undici has CRLF Injection in undici via `upgrade` option

Axios is vulnerable to DoS attack through lack of data size check

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios: Header Injection via Prototype Pollution

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Allocation of Resources Without Limits or Throttling in Axios

@isaacs/brace-expansion has Uncontrolled Resource Consumption

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

auth0/node-jws Improperly Verifies HMAC Signature

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Picomatch has a ReDoS vulnerability via extglob quantifiers

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

form-data: CRLF injection in form-data via unescaped multipart field names and filenames

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

brace-expansion: Large numeric range defeats documented `max` DoS protection

Axios: no_proxy bypass via IP alias allows SSRF

js-yaml has prototype pollution in merge (<<)

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter